@protobase/server 0.68.5 → 0.69.0

package/dist/better-auth/connections/declared-connections.js

@@ -0,0 +1,54 @@
+import { connectionProviderId } from "../../workflows/connections/connection-provider.js";
+import { isIP } from "node:net";
+//#region src/better-auth/connections/declared-connections.ts
+const clientOf = (value) => typeof value?.clientId === "string" && value.clientId !== "" && typeof value.clientSecret === "string" && value.clientSecret !== "" ? {
+	clientId: value.clientId,
+	clientSecret: value.clientSecret
+} : void 0;
+const literalHost = (url) => {
+	const host = new URL(url).hostname.replace(/^\[|\]$/g, "");
+	return host === "localhost" || isIP(host) !== 0;
+};
+/**
+* The connections of an app's workflow plugins, each with its provider: the sign-in provider it names, whose client
+* revokes its tokens, or one of its own, whose client `clients` gives by `<plugin>:<connection>`. Startup stops on a
+* client no `oauth` connection declares, and on an endpoint by address unless `allowPrivateAddresses`.
+*/
+const resolveConnections = (declared, clients, socialProviders, allowPrivateAddresses) => {
+	const keys = new Set(declared.filter(({ declaration }) => "oauth" in declaration).map(({ plugin, name }) => `${plugin}:${name}`));
+	const unknown = Object.keys(clients).find((key) => !keys.has(key));
+	if (unknown !== void 0) throw new Error(`auth.connections: "${unknown}" is no workflow plugin's connection that signs in through a provider of its own`);
+	return declared.map((connection) => {
+		const { plugin, name, declaration } = connection;
+		const key = `${plugin}:${name}`;
+		const providerId = connectionProviderId(plugin, name, declaration);
+		const urls = "signIn" in declaration ? [declaration.revocation_url] : [
+			declaration.oauth.authorization_url,
+			declaration.oauth.token_url,
+			declaration.oauth.user_info_url,
+			declaration.oauth.revocation_url
+		];
+		if (!allowPrivateAddresses && urls.some((url) => url !== void 0 && literalHost(url))) throw new Error(`Workflow plugin "${plugin}": the connection "${name}" names a host by its address; give its provider's name, or allow private addresses for development (workflows.allowPrivateAddresses)`);
+		if ("signIn" in declaration) {
+			const client = clientOf(socialProviders[declaration.signIn]);
+			return {
+				...connection,
+				key,
+				providerId,
+				...client && { client },
+				...declaration.revocation_url && { revocationUrl: declaration.revocation_url }
+			};
+		}
+		const client = clientOf(clients[key]);
+		if (Object.hasOwn(clients, key) && !client) throw new Error(`auth.connections: "${key}" needs its clientId and clientSecret`);
+		return {
+			...connection,
+			key,
+			providerId,
+			...client && { client },
+			...declaration.oauth.revocation_url && { revocationUrl: declaration.oauth.revocation_url }
+		};
+	});
+};
+//#endregion
+export { resolveConnections };

package/dist/better-auth/connections/revoke-token.js

@@ -0,0 +1,34 @@
+import { AddressRefusedError, pinnedRequest } from "../../webhooks/table/pinned-request.js";
+//#region src/better-auth/connections/revoke-token.ts
+/** The longest a provider gets to revoke a token: disconnecting does not wait on it any longer. */
+const revokeTimeoutMs = 1e4;
+const unreachable = (error) => error instanceof AddressRefusedError || error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError" || typeof error.code === "string");
+/**
+* Revokes a token at its provider (RFC 7009), through the guarded request, which refuses a private address unless the
+* app allows them: whether the provider took it. A provider out of reach or refusing is false, so disconnecting still
+* deletes the token; nothing of the request or its answer is logged or returned, as both carry the token.
+*/
+const revokeToken = async ({ url, client, token, hint, allowPrivateAddresses }) => {
+	const init = {
+		method: "POST",
+		headers: { "content-type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			token,
+			token_type_hint: hint,
+			...client && {
+				client_id: client.clientId,
+				client_secret: client.clientSecret
+			}
+		}).toString(),
+		signal: AbortSignal.timeout(revokeTimeoutMs)
+	};
+	const response = await pinnedRequest(url, init, { allowPrivateAddresses }).catch((error) => {
+		if (unreachable(error)) return;
+		throw error;
+	});
+	if (!response) return false;
+	await response.body?.cancel();
+	return response.ok;
+};
+//#endregion
+export { revokeToken };

package/dist/better-auth/create-auth.d.ts

@@ -5,12 +5,13 @@ import { StaffSignIn } from "./staff-log.js";
 import { Person } from "./organizations/people-endpoint.js";
 import { RoleDefinitions, RolesInput } from "./organizations/role-definitions.js";
 import { ConnectedApp } from "./mcp/connected-apps.js";
-import { ReplacingContext } from "./end-replaced-session.js";
 import { VersionedSecret } from "./secret-versions.js";
 import { UserDeletionListener } from "./user-deletion.js";
 import { OrganizationRole } from "./organizations/store.js";
 import { OrganizationsOptions, ResolvedOrganizations } from "./organizations/options.js";
 import { PersonalMailProvider } from "../personal-mail/personal-mail-provider.js";
+import { ConnectionClient, DeclaredConnection, ResolvedConnection } from "./connections/declared-connections.js";
+import { ConnectionListener } from "./connections/connection-events.js";
 import { McpAuthOptions } from "./mcp/mcp-plugins.js";
 import { OperatorProvider } from "./operator-provider.js";
 import { PlatformSignIn } from "./platform-sign-in.js";
@@ -117,8 +118,22 @@ export type CreateAuthOptions = {
    * `socialProviders` must have: Gmail through `google`. Needs `encryptOAuthTokens`. Default none.
    */
   personalMail?: PersonalMailProviderId[];
-  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` needs it. Default off. */
+  /** Encrypt the OAuth access and refresh tokens Better Auth stores for social sign-ins, with `secret`; `personalMail` and workflow connections need it. Default off. */
   encryptOAuthTokens?: boolean;
+  /**
+   * The OAuth client of each workflow plugin's connection that signs in through a provider of its own, by
+   * `<plugin>:<connection>`, such as `{ 'acme:account': { clientId, clientSecret } }`; its redirect URI is
+   * `{baseURL}/api/auth/callback/workflow-<plugin>-<connection>`. A connection through one of `socialProviders` needs none.
+   */
+  connections?: Record<string, ConnectionClient>;
+  /**
+   * The connections the app's workflow plugins declare, which people connect accounts through (`createAdmin` passes
+   * them from `workflows.plugins`), and whether their providers may be at private addresses, for development and tests.
+   */
+  workflowConnections?: {
+    declared: DeclaredConnection[];
+    allowPrivateAddresses?: boolean;
+  };
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;
   /**
@@ -299,6 +314,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
   account: {
     encryptOAuthTokens?: true | undefined;
     accountLinking: {
+      trustedProviders?: string[] | undefined;
       allowDifferentEmails: true;
     };
     fields: {
@@ -590,17 +606,7 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
               userId: string;
               expiresAt: Date;
               token: string;
-              ipAddress?
-              /**
-               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
-               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
-               * people mostly never set one. Only while the policy leaves both on; default `password`.
-               */
-              /**
-               * What the sign-in page leads with: `password`, the email address and a password, with emailing a code below it; or
-               * `emailCode`, the address and "Email me a sign-in code", with the password behind "Use a password", for apps whose
-               * people mostly never set one. Only while the policy leaves both on; default `password`.
-               */ : string | null | undefined;
+              ipAddress?: string | null | undefined;
               userAgent?: string | null | undefined;
             };
           };
@@ -3419,6 +3425,102 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       INVALID_OAUTH_CONFIGURATION: import("better-auth").RawError<"INVALID_OAUTH_CONFIGURATION">;
       TOKEN_URL_NOT_FOUND: import("better-auth").RawError<"TOKEN_URL_NOT_FOUND">;
     };
+  } | {
+    id: "protobase-connection-providers";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
+  } | {
+    id: "protobase-connections";
+    endpoints: {
+      listConnections: import("better-call").StrictEndpoint<string, {
+        method: "GET";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+      }, {
+        connections: {
+          key: string;
+          label: string;
+          provider: string;
+          scopes: string[];
+          link_params: Record<string, string>;
+          accounts: {
+            id: string;
+            scopes: string[];
+            created_at: Date;
+            needs_sign_in: boolean;
+          }[];
+        }[];
+      }>;
+      disconnectConnection: import("better-call").StrictEndpoint<string, {
+        method: "POST";
+        use: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<{
+          session: {
+            session: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              userId: string;
+              expiresAt: Date;
+              token: string;
+              ipAddress?: string | null | undefined;
+              userAgent?: string | null | undefined;
+            };
+            user: Record<string, any> & {
+              id: string;
+              createdAt: Date;
+              updatedAt: Date;
+              email: string;
+              emailVerified: boolean;
+              name: string;
+              image?: string | null | undefined;
+            };
+          };
+        }>>[];
+        body: import("zod").ZodObject<{
+          accountId: import("zod").ZodString;
+        }, import("zod/v4/core").$strip>;
+      }, {
+        disconnected: boolean;
+        revoked: boolean;
+      }>;
+    };
+    hooks: {
+      before: {
+        matcher: (context: import("better-auth").HookEndpointContext) => boolean;
+        handler: import("better-call").Middleware<import("better-call").MiddlewareOptions, (inputContext: import("better-call").MiddlewareInputContext<import("better-call").MiddlewareOptions>) => Promise<void>>;
+      }[];
+    };
+  } | {
+    id: "protobase-refresh-refusals";
+    init: (ctx: import("better-auth").AuthContext) => {
+      context: {
+        socialProviders: import("better-auth").OAuthProvider<object, Partial<import("better-auth").ProviderOptions<object>>>[];
+      };
+    };
   } | {
     id: "sso";
     version: string;
@@ -8978,10 +9080,40 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
       };
     };
     session: {
-      create: {
-        after: (session: {
-          token: string;
-        }, ctx: ReplacingContext | null) => Promise<void>;
+      create?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          } & Record<string, any>;
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      update?: {
+        before?: (session: Partial<import("better-auth").Session> & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void | {
+          data: {
+            [x: string]: any;
+            id?: string | undefined;
+            createdAt?: Date | undefined;
+            updatedAt?: Date | undefined;
+            userId?: string | undefined;
+            expiresAt?: Date | undefined;
+            token?: string | undefined;
+            ipAddress?: string | null | undefined;
+            userAgent?: string | null | undefined;
+          };
+        }>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
+      };
+      delete?: {
+        before?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<boolean | void>;
+        after?: (session: import("better-auth").Session & Record<string, unknown>, context: import("better-auth").GenericEndpointContext | null) => Promise<void>;
       };
     };
     account: {
@@ -9201,6 +9333,19 @@ export declare const createAuth: (options: CreateAuthOptions, plugins?: AuthPlug
   personalMail: PersonalMailProvider[];
   /** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
   personalMailer: (userId: string) => Mailer;
+  /** What workflow connections can sign in with: whether tokens are stored encrypted, the sign-in providers, the connections with a client. */
+  connectionSupport: {
+    encrypted: boolean;
+    signInProviders: string[];
+    clients: string[];
+  };
+  /** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+  connections: {
+    declared: ResolvedConnection[];
+    events: {
+      set: (next: ConnectionListener) => undefined;
+    };
+  };
   /** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
   mcp: {
     resource: string;

package/dist/better-auth/create-auth.js

@@ -5,10 +5,16 @@ import { defaultSignInPolicy } from "./sign-in-policy.js";
 import { roleDefinitions } from "./organizations/role-definitions.js";
 import { signInPolicyPlugin } from "./policy-plugin.js";
 import { goTrueSessionsPlugin } from "../gotrue/sessions-plugin.js";
+import { refreshRefusalsPlugin } from "./refresh-refusals.js";
 import { betterAuthLinkedAccounts } from "../personal-mail/linked-accounts.js";
 import { resolvePersonalMail } from "../personal-mail/personal-mail-providers.js";
 import { personalMailer } from "../personal-mail/personal-mailer.js";
 import { mailLinkHooks } from "../personal-mail/mail-link-hooks.js";
+import { bothAccountHooks, connectionAccountHooks } from "./connections/connection-account-hooks.js";
+import { connectionEvents } from "./connections/connection-events.js";
+import { connectionProvidersPlugin } from "./connections/connection-oauth-provider.js";
+import { connectionsPlugin } from "./connections/connections-plugin.js";
+import { resolveConnections } from "./connections/declared-connections.js";
 import { endReplacedSession } from "./end-replaced-session.js";
 import { authBasePath } from "./auth-base-path.js";
 import { authLogger } from "./auth-logger.js";
@@ -69,6 +75,20 @@ const withEndedReplaced = (hooks) => ({
 		after: endReplacedSession
 	}
 });
+const refusingConnectionSessions = (hooks, refuse) => {
+	if (!refuse) return hooks;
+	const before = hooks.create?.before;
+	return {
+		...hooks,
+		create: {
+			...hooks.create,
+			before: async (session, context) => {
+				await refuse(session, context);
+				return before?.(session, context);
+			}
+		}
+	};
+};
 const platformOperator = () => readOperatorSettings(globalThis.process?.env ?? {});
 const platformSignInSettings = () => readPlatformSignIn(globalThis.process?.env ?? {});
 const platformOrigins = () => readOrigins(globalThis.process?.env ?? {});
@@ -101,7 +121,9 @@ const organizationPaths = ["/organization/set-active", "/organization/accept-inv
 * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
 * sign-in provider already resolved.
 */
-const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, lockedAccounts = [], ...plugins }) => {
+const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, definitions, defaultRole, appName = defaultAppName, mailer, signUpRole, operator, platformSignIn, saml = [], organizations, mcp, context = noContext, signInPolicy = defaultSignInPolicy, mobile, deletion, lockedAccounts = [], connections, ...plugins }) => {
+	const connectionHooks = connections && connections.resolved.length > 0 ? connectionAccountHooks(connections.resolved, connections.events) : void 0;
+	const ownProviders = (connections?.resolved ?? []).filter(({ declaration }) => "oauth" in declaration).map(({ providerId }) => providerId);
 	const secure = options.baseURL.startsWith("https://");
 	const signIn = platformSignInFor(platformSignIn, Object.keys(options.socialProviders ?? {}));
 	const hosts = passkeyHosts([options.baseURL, ...origins]);
@@ -201,7 +223,10 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 		verification: coreNames.verification,
 		account: {
 			...coreNames.account,
-			accountLinking: { allowDifferentEmails: true },
+			accountLinking: {
+				allowDifferentEmails: true,
+				...ownProviders.length > 0 && { trustedProviders: ownProviders }
+			},
 			...options.encryptOAuthTokens && { encryptOAuthTokens: true }
 		},
 		plugins: [
@@ -238,6 +263,12 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				defaultPolicy: signInPolicy
 			})] : [],
 			...signIn ? [genericOAuth({ config: [platformSignInProvider(signIn)] })] : [],
+			...connections && connections.resolved.length > 0 ? [connectionProvidersPlugin(connections.resolved, { allowPrivateAddresses: connections.allowPrivateAddresses }), connectionsPlugin({
+				connections: connections.resolved,
+				events: connections.events,
+				allowPrivateAddresses: connections.allowPrivateAddresses
+			})] : [],
+			refreshRefusalsPlugin(),
 			...saml.length > 0 ? [loaded(plugins.samlPlugin, "sso.saml")(saml, options.baseURL), samlGuardPlugin(samlIds)] : [],
 			signInPolicyPlugin(policy),
 			passwordChecksPlugin(),
@@ -320,8 +351,8 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 				},
 				update: { before: async (user) => ({ data: confirmedOnUpdate(user, /* @__PURE__ */ new Date()) }) }
 			},
-			session: withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {}),
-			account: mailLinkHooks(resolvePersonalMail(options.personalMail ?? [], Object.keys(options.socialProviders ?? {}), options.encryptOAuthTokens === true))
+			session: refusingConnectionSessions(withEndedReplaced(organizations ? sessionOrganizationHooks(context) : {}), connectionHooks?.session.create?.before),
+			account: ((mail) => connectionHooks ? bothAccountHooks(mail, connectionHooks.account) : mail)(mailLinkHooks(resolvePersonalMail(options.personalMail ?? [], Object.keys(options.socialProviders ?? {}), options.encryptOAuthTokens === true)))
 		},
 		rateLimit: {
 			enabled: true,
@@ -408,6 +439,13 @@ const createAuth = (options, plugins = {}) => {
 	const platformSignIn = platformSignInFor(signInSettings && resolvePlatformSignIn(signInSettings), socialProviders);
 	const saml = resolveSamlProviders(options.sso?.saml ?? [], [...socialProviders, ...platformSignIn ? [platformSignIn.provider] : []]);
 	const personalMail = resolvePersonalMail(options.personalMail ?? [], socialProviders, options.encryptOAuthTokens === true);
+	if (Object.keys(options.connections ?? {}).length > 0 && options.encryptOAuthTokens !== true) throw new Error("auth.connections: the connected accounts' tokens would be stored in plain text; turn on auth.encryptOAuthTokens");
+	const allowPrivateAddresses = options.workflowConnections?.allowPrivateAddresses === true;
+	const resolvedConnections = resolveConnections(options.workflowConnections?.declared ?? [], options.connections ?? {}, options.socialProviders ?? {}, allowPrivateAddresses);
+	const clash = resolvedConnections.find(({ declaration, providerId }) => "oauth" in declaration && socialProviders.includes(providerId));
+	if (clash) throw new Error(`Workflow plugin "${clash.plugin}": its connection "${clash.name}" signs in as "${clash.providerId}", which is a sign-in provider's id too`);
+	const connectionClients = resolvedConnections.filter(({ declaration, client }) => "oauth" in declaration && client).map(({ key }) => key);
+	const events = connectionEvents();
 	const origins = resolveOrigins(options.baseURL, options.origins ?? platformOrigins());
 	const passkeyDomain = resolvePasskeyDomain(options.passkeyDomain ?? platformPasskeyDomain(), [options.baseURL, ...origins]);
 	const organizations = options.organizations && resolveOrganizations(options.organizations, definitions);
@@ -436,7 +474,12 @@ const createAuth = (options, plugins = {}) => {
 		signInPolicy,
 		...organizations && { organizations },
 		...mcp && { mcp },
-		context
+		context,
+		connections: {
+			resolved: resolvedConnections,
+			events,
+			allowPrivateAddresses
+		}
 	});
 	assertNoEndpointKeyClashes(authOptions.plugins);
 	const auth = betterAuth(authOptions);
@@ -503,6 +546,17 @@ const createAuth = (options, plugins = {}) => {
 		personalMail,
 		/** Mail from `userId`'s own mailbox, through the mail provider they linked (see `personalMailer`). */
 		personalMailer: (userId) => personalMailer(betterAuthLinkedAccounts(auth), personalMail, userId),
+		/** What workflow connections can sign in with: whether tokens are stored encrypted, the sign-in providers, the connections with a client. */
+		connectionSupport: {
+			encrypted: options.encryptOAuthTokens === true,
+			signInProviders: socialProviders,
+			clients: connectionClients
+		},
+		/** The workflow connections people connect accounts through, and the listener (`set`) the workflows give for their links and disconnects. */
+		connections: {
+			declared: resolvedConnections,
+			events: { set: events.set }
+		},
 		/** The OAuth provider for MCP clients, when on: the endpoint's resource (its URL) and path, and the scope its tokens carry. */
 		mcp: mcp && {
 			resource: mcp.resource,

package/dist/better-auth/refresh-refusals.js

@@ -0,0 +1,43 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+//#region src/better-auth/refresh-refusals.ts
+/**
+* The token endpoint's error (RFC 6749, section 5.2) that refuses the refresh token itself, as for a revoked grant or
+* an expired refresh token: the link no longer signs in, and only connecting it again helps.
+*/
+const refusal = "invalid_grant";
+/** Whether a provider's refresh threw for a refused grant: Better Auth's own fetch's error, or a connection provider's. */
+const refreshRefused = (error) => typeof error === "object" && error !== null && error.error === refusal;
+const watched = new AsyncLocalStorage();
+/** Runs `work` and tells whether a provider refused a refresh token in it, whether `work` resolved or threw. */
+const watchRefusals = async (work) => {
+	const outcome = { refused: false };
+	return {
+		...await watched.run(outcome, () => work().then((value) => ({ value }), (error) => ({ error }))),
+		refused: outcome.refused
+	};
+};
+const marking = (provider) => {
+	const refresh = provider.refreshAccessToken;
+	if (!refresh) return provider;
+	return {
+		...provider,
+		refreshAccessToken: async (...args) => {
+			try {
+				return await refresh(...args);
+			} catch (error) {
+				if (refreshRefused(error)) {
+					const outcome = watched.getStore();
+					if (outcome) outcome.refused = true;
+				}
+				throw error;
+			}
+		}
+	};
+};
+/** Has every provider's refresh mark a refused grant for `watchRefusals`; after the plugins that add providers. */
+const refreshRefusalsPlugin = () => ({
+	id: "protobase-refresh-refusals",
+	init: (ctx) => ({ context: { socialProviders: ctx.socialProviders.map(marking) } })
+});
+//#endregion
+export { refreshRefusalsPlugin, refreshRefused, watchRefusals };

package/dist/better-auth/staff-checks.js

@@ -46,6 +46,7 @@ const accountChanges = [
 	"/delete-user",
 	"/link-social",
 	"/unlink-account",
+	"/connections/disconnect",
 	"/revoke-sessions",
 	"/revoke-other-sessions",
 	"/two-factor/enable",

package/dist/create-admin.js

@@ -59,6 +59,8 @@ import { toApiFunction } from "./functions/define-function.js";
 import { createWebhooks } from "./webhooks/webhooks.js";
 import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionUrlCheck, subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
+import { hooksBase } from "./workflows/hooks/hook-paths.js";
+import { issueWebhook } from "./workflows/hooks/issue-webhook.js";
 import { workflowEngine } from "./workflows/workflow-engine.js";
 import { workflowTypesRoute } from "./workflows/workflow-types-route.js";
 import { callsService } from "./calls/calls-service.js";
@@ -387,7 +389,13 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			sql: options.mcp !== false && options.mcp?.sql === true,
 			writes,
 			commented,
-			...engine && { workflows: engine.types },
+			...engine && { workflows: {
+				...engine.types,
+				issueWebhook: (session, id, secret) => issueWebhook(engine.issue, session, id, {
+					...secret !== void 0 && { secret },
+					origin: new URL(auth.mcp.resource).origin
+				})
+			} },
 			own: options.mcp !== false && options.mcp?.tools || []
 		});
 		const instructions = engine ? `${mcpInstructions}\n${workflowInstructions}` : mcpInstructions;
@@ -555,7 +563,9 @@ const createAdmin = ({ resources: appResources, views: appViews = [], userTables
 			}));
 		}
 	}
+	if (engine) app.route(hooksBase(systemPath), engine.routes.hooks());
 	if (appModels.some((model) => model.live) || deps.calls) app.route(systemPath || "/", guarded((live) => void live.route("/", liveRoutes(feed, (session) => visibleNotices(deps, session))), withAnonymous(authenticate, options.roles)));
+	if (engine) app.route(`${systemPath}/workflows`, guarded((routes) => void routes.route("/", engine.routes.issue())));
 	app.route(basePath, api);
 	app.route(`${deps.systemPath}/meta`, metaApp);
 	app.route(systemPath || "/", webManifestRoute(appName, identity, icons));

package/dist/forms/rate-limit.js

@@ -8,32 +8,54 @@ const windowMs = 6e4;
 * sent). In development and tests a request without one is `127.0.0.1`.
 */
 const clientAddress = (headers) => getIP(headers, {}) ?? "unknown";
+/** The most keys a limit counts at once: a new key past it forgets the one whose window began first. */
+const rateLimitKeys = 1e4;
 /**
 * At most `perMinute` takes per key in a fixed window of a minute, kept in this process. Keys whose window has passed are
-* dropped as new ones come, so memory follows the clients of the last minute.
+* dropped as new ones come, and at most `maxKeys` are kept, the oldest window dropped first, so memory stays bounded
+* however many clients come within a minute.
 */
-const createRateLimit = ({ now = Date.now } = {}) => {
+const createRateLimit = ({ now = Date.now, maxKeys = rateLimitKeys } = {}) => {
 	const windows = /* @__PURE__ */ new Map();
 	const prune = (at) => {
-		for (const [key, window] of windows) if (at - window.start >= windowMs) windows.delete(key);
+		for (const [key, window] of windows) {
+			if (at - window.start < windowMs) return;
+			windows.delete(key);
+		}
+	};
+	const open = (key, at) => {
+		prune(at);
+		windows.delete(key);
+		if (windows.size >= maxKeys) windows.delete(windows.keys().next().value);
+		windows.set(key, {
+			start: at,
+			count: 1
+		});
+	};
+	const wait = (key, perMinute, at) => {
+		const current = windows.get(key);
+		if (!current || at - current.start >= windowMs || current.count < perMinute) return 0;
+		return Math.ceil((current.start + windowMs - at) / 1e3);
 	};
 	/** Counts a take for `key`: `0` when allowed, else the seconds until its window lets it through again. */
 	const take = (key, perMinute) => {
 		const at = now();
 		const current = windows.get(key);
 		if (!current || at - current.start >= windowMs) {
-			prune(at);
-			windows.set(key, {
-				start: at,
-				count: 1
-			});
+			open(key, at);
 			return 0;
 		}
-		if (current.count >= perMinute) return Math.ceil((current.start + windowMs - at) / 1e3);
+		const seconds = wait(key, perMinute, at);
+		if (seconds > 0) return seconds;
 		current.count += 1;
 		return 0;
 	};
-	return { take };
+	/** Whether `key` has spent its `perMinute` takes, without taking one: the seconds to wait, or `0`. */
+	const spent = (key, perMinute) => wait(key, perMinute, now());
+	return {
+		take,
+		spent
+	};
 };
 //#endregion
-export { clientAddress, createRateLimit };
+export { clientAddress, createRateLimit, rateLimitKeys };

package/dist/forms/routes.js

@@ -1,8 +1,8 @@
 import { HttpProblem, badRequest, notFound } from "../problem.js";
 import { runWrite } from "../write-pipeline.js";
 import { anonymousSession } from "../anonymous.js";
-import { pruneView } from "../view-access.js";
 import { clientAddress } from "./rate-limit.js";
+import { pruneView } from "../view-access.js";
 import { Hono } from "hono";
 import { restrictModel } from "@protobase/schema";
 //#region src/forms/routes.ts

package/dist/functions/verify-signature.js

@@ -1,4 +1,5 @@
 import { HttpProblem } from "../problem.js";
+import { timingSafeEqual } from "node:crypto";
 //#region src/functions/verify-signature.ts
 const invalid = (detail) => new HttpProblem(401, "invalid-signature", "Unauthorized", detail);
 const decodeHex = (text) => /^(?:[0-9a-f]{2})+$/i.test(text) ? new Uint8Array(text.match(/../g).map((pair) => parseInt(pair, 16))) : void 0;
@@ -7,8 +8,9 @@ const verifyHmac = async (key, hash, signature, content) => {
 	const cryptoKey = await crypto.subtle.importKey("raw", key, {
 		name: "HMAC",
 		hash
-	}, false, ["verify"]);
-	return crypto.subtle.verify("HMAC", cryptoKey, signature, new TextEncoder().encode(content));
+	}, false, ["sign"]);
+	const expected = new Uint8Array(await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(content)));
+	return signature.length === expected.length && timingSafeEqual(signature, expected);
 };
 /**
 * The request's body as text, once its HMAC signature checks out against `secret`, as GitHub, Shopify and many others